fedipod 1.48.0 → 1.49.0

package/lib/gateway/front-core.mjs

@@ -18,16 +18,17 @@
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
 import { ownerPostAtDoor } from './outbox-door.mjs';
-import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
+import { readCapped, safeFetch, isLoopbackHost, namesPrivateAddress } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi } from './held-mail.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
-import { podTokenVerifier } from './caches.mjs';
-import { claimedWebId } from './token-claims.mjs';
+import { claimedWebId, verifyPodToken } from './token-claims.mjs';
+
+export { verifyPodToken };
 import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
@@ -35,16 +36,15 @@ import { announced, overLimit, relayOne } from './relay-extras.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null, avatar = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
   links: [
     { rel: 'self', type: 'application/activity+json', href: actor },
     ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
-    // Remote follow. Somebody reading this account on another server presses
-    // Follow, says they are here, and that server looks for this link to find
-    // out where to send them. `{uri}` is a literal the other server fills in
-    // with whatever they are following — it must not be escaped.
+    ...(avatar ? [{ rel: 'http://webfinger.net/rel/avatar', href: avatar }] : []),   // the account's picture
+    // Remote follow: another server sends its reader to this template to follow
+    // from there. `{uri}` is a literal that server fills in; never escape it.
     ...(subscribe ? [{ rel: 'http://ostatus.org/schema/1.0/subscribe', template: subscribe }] : []),
   ],
 });
@@ -57,29 +57,6 @@ const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' :
 
 const AP_CT = 'application/activity+json';
 
-// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
-// verifier is injected so tests stub it; in production it is the same library
-// the agent's own C2S auth uses.
-export async function verifyPodToken(request, pathname, verifier) {
-  const authz = request.headers.get('authorization');
-  if (!authz) return null;
-  try {
-    const dpop = request.headers.get('dpop');
-    // Solid-OIDC binds the token to a key the client proves on every request;
-    // a token shown without the proof is one anyone who saw it could show.
-    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || await podTokenVerifier();
-    const url = request.url;
-    const { webid } = await v(authz, { header: dpop, method: request.method, url });
-    return webid || null;
-  } catch (e) {
-    // Said aloud: a token the front will not take is otherwise a bare 401 to
-    // the caller and nothing at all here.
-    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
-    return null;
-  }
-}
-
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
 // origin — that is the whole proof: a token for a WebID under podHome could
 // only be minted by someone who controls that pod's identity provider.
@@ -105,6 +82,13 @@ function webidUnderPod(webid, podHome) {
   } catch { return false; }
 }
 
+// Whether a WebID is this row's owner: the one recorded, or for a row from
+// before WebIDs were recorded, one living on the row's pod.
+const ownsRow = (rec) => (webid) => (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome));
+
+// A front on this machine: a test run, whose pods and identity providers are here too.
+const frontOnThisMachine = (ctx) => { try { return isLoopbackHost(new URL(ctx.frontOrigin).hostname); } catch { return false; } };
+
 /**
  * Whether this WebID may speak for this pod.
  *
@@ -362,7 +346,7 @@ async function route(request, ctx) {
   // Solid-OIDC token — and must be the WebID the deploy names as admin.
   if (pathname === '/api/roster') {
     if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     const rows = await ctx.listDirectory();
@@ -382,7 +366,7 @@ async function route(request, ctx) {
   // for good; a row seeded in the deploy's environment can only be removed there.
   if (pathname === '/api/revoke' && request.method === 'POST') {
     if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     let body;
@@ -471,7 +455,12 @@ async function route(request, ctx) {
     }
     const badPod = podHomeProblem(podHome, ctx.frontOrigin);
     if (badPod) return j(400, { error: badPod });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    // Anyone may sign up, so the pod and the token's addresses are a
+    // stranger's to name, and checking them fetches them. A front on the
+    // internet fetches only public ones; one on this machine, for testing, its own.
+    const publicOnly = !frontOnThisMachine(ctx);
+    if (publicOnly && await namesPrivateAddress(podHome)) return j(400, { error: 'that pod address is not on the public internet' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { publicOnly });
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!await provesPod(webid, podHome, ctx.fetchImpl)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
@@ -572,10 +561,9 @@ async function route(request, ctx) {
       return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
     }
     if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    if (!ownsRow(rec)(webid)) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
     const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
     await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
     console.log(`front @${handle}: moved to ${movedTo}`);
@@ -585,9 +573,9 @@ async function route(request, ctx) {
   // The owner's say over an account that goes quiet (quiet.mjs).
   const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
   if (quiet) return withApiCors(quiet);
-  // The owner's app saying it is open, and taking what was held (held-mail.mjs).
-  const here = await routeHereApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner })
-    || await routeKeeperApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner });
+  // The owner's app saying it is open, taking what was held, and naming what to push (held-mail.mjs).
+  const owned = { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner };
+  const here = await routeHereApi(request, pathname, ctx, owned) || await routeKeeperApi(request, pathname, ctx, owned) || await routePushApi(request, pathname, ctx, owned);
   if (here) return withApiCors(here);
 
   // The relay: the front sends requests a browser has already signed. A page
@@ -604,10 +592,9 @@ async function route(request, ctx) {
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
     if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
+    if (!ownsRow(rec)(webid)) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
     // Acting through the relay is being here. Hourly at most; see noteOpened.
@@ -678,6 +665,16 @@ async function route(request, ctx) {
     if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
       return j(403, { error: 'that is not a pod address' });
     }
+    // A server that runs identities runs them for its own pods only, and says
+    // which those are. Asked before anything is fetched: the checks below read
+    // the addresses the request names, and a stranger names them.
+    if (ctx.agentControl.serves) {
+      if (!await ctx.agentControl.serves(podBase)) return j(403, { error: 'that pod is not on this server' });
+      const claimed = claimedWebId(request);
+      if (claimed && !await ctx.agentControl.serves(claimed)) {
+        return j(403, { error: 'the token is for a WebID on another server' });
+      }
+    }
     // The pod's own server names its owner when it can, and where it does that
     // is the proof. Where it does not, the WebID must live in EXACTLY this pod
     // — its own pod base equal to podBase, not merely starting with it, which on
@@ -758,7 +755,7 @@ async function route(request, ctx) {
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
     const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor,
-      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin) }),
+      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin), avatar: rec.icon || null }),
     'application/jrd+json');
     // RFC 7033: a JRD is read from any origin.
     out.headers['access-control-allow-origin'] = '*';

package/lib/gateway/gateway-core.mjs

@@ -112,7 +112,10 @@ export function asSigned(request, bytes, origin) {
 }
 
 // `origin` is the door's own, the one senders address (see asSigned).
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+// `admit(verified)`, when given, says whether the inbox has room for this
+// delivery now; one without room is answered 503 and written nowhere, so its
+// sender tries again later. Without it every delivery that passes is written.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null } = {}) {
   // The body, once, as the bytes the sender digested; the text of it is what
   // is filed and hashed, as before.
   let bytes, raw;
@@ -157,6 +160,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
+  if (admit && !admit(v.verified === true)) return { status: 503, reason: 'inbox full — try later' };
+
   // No per-user secret on record = no receipt: the delivery still filters and
   // forwards, it just reads as unverified at the drain — never a failure.
   const receipt = ident.hmacSecret

package/lib/gateway/held-mail.mjs

@@ -213,3 +213,26 @@ export async function routeHereApi(request, pathname, ctx, deps) {
   // `hold`: with it off, a browser working from a copy goes back to the pod.
   return j(200, { ok: true, handle, flushed, hold: holdOn(ctx) });
 }
+
+// FediPod open in a browser reads its own mail, so nothing is held for the
+// door to push: it names the notifications it made, and they are pushed to the
+// phones and browsers its owner signed up (masto-gateway.mjs: pushMade).
+// Proved like /api/here. Returns a response, or null for other paths.
+const NOTIFICATION_ID = /^[0-9a-f]{16}$/u;
+export async function routePushApi(request, pathname, ctx, deps) {
+  if (pathname !== '/api/push') return null;
+  const { j } = deps;
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const handle = String(body.handle || '').toLowerCase();
+  const rec = await ctx.lookup(handle);
+  if (!rec) return j(404, { error: 'no such account' });
+  const who = await deps.provedOwner(request, pathname, ctx, rec, deps);
+  if (who.error) return who.error;
+  const ids = [...new Set((Array.isArray(body.ids) ? body.ids : []).filter((id) => NOTIFICATION_ID.test(String(id))))].slice(0, 50);
+  if (!ids.length || !ctx.startPush || !await ctx.pushWanted?.(handle).catch(() => false)) return j(200, { ok: true, handle, pushing: 0 });
+  await ctx.startPush(handle, { ids }).catch((e) => console.log(`push @${handle}: not started: ${e?.message || e}`));
+  return j(200, { ok: true, handle, pushing: ids.length });
+}

package/lib/gateway/masto-gateway.mjs

@@ -29,7 +29,10 @@
 // keeps for all its accounts, made the first time it is needed. When the door
 // holds a delivery that becomes a notification (gateway-core: notifies), it
 // starts a short run (push-background.mjs, pushHeld below) that reads the held
-// mail into the copy and pushes each notification it makes.
+// mail into the copy and pushes each notification it makes. While FediPod is
+// open in a browser, it reads the mail itself and names the notifications it
+// made (held-mail.mjs: /api/push); those are pushed from the account as it
+// reads (pushMade below).
 import crypto from 'node:crypto';
 import { MastoApi } from '../client/masto/index.mjs';
 import { instanceConfig } from '../client/masto/instance.mjs';
@@ -49,7 +52,10 @@ import { noteOpened } from './quiet.mjs';
 import { Push } from '../client/webpush.mjs';
 import webpush from 'web-push';
 
+// An app stays signed in for ninety days from its last use; the mark of use
+// moves at most once a day.
 const TOKEN_TTL_MS = 90 * 86400_000;
+const TOKEN_USE_MARK_MS = 86400_000;
 const CODE_TTL_MS = 10 * 60_000;
 const MAIL_EVERY_MS = 30_000;
 const SIGNIN_PAGE = '/app-signin/';
@@ -194,8 +200,11 @@ export async function vapidKeys(kv) {
 }
 
 class GatewayPush extends Push {
-  constructor({ keys, ...o }) { super(o); this.keys = keys; }
+  constructor({ keys, keep = true, ...o }) { super(o); this.keys = keys; this.keep = keep; }
   vapid() { return this.keys; }
+  // Pushing from an account only read: a sign-up the push service has dropped
+  // is let go by the next push that acts on the account.
+  save(s) { if (this.keep) super.save(s); }
 }
 
 // ---- the account behind a token ----
@@ -282,10 +291,10 @@ function readingAgent(at, store, acting, log) {
 // contact address push services accept (https or mailto).
 const pushContact = (ctx) => (/^https:\/\//u.test(ctx.frontOrigin || '') ? `${ctx.frontOrigin.replace(/\/$/u, '')}/` : `mailto:postmaster@${ctx.host || 'localhost'}`);
 
-function facade(agent, token, log, keys = null, contact = null) {
+function facade(agent, token, log, keys = null, contact = null, { keep = true } = {}) {
   const api = new MastoApi({ agent, log, scheme: 'https', streaming: false, webPush: !!keys, scheduling: true, allowed: noAuthorities });
   api.tokenOf = () => token;
-  if (keys) api._push = new GatewayPush({ store: agent.store, keys, log, subject: () => contact });
+  if (keys) api._push = new GatewayPush({ store: agent.store, keys, log, subject: () => contact, keep });
   return api;
 }
 
@@ -390,6 +399,40 @@ export async function pushHeld(ctx, handle, rec, { log = console.log } = {}) {
   return n;
 }
 
+/**
+ * For FediPod open in a browser, which read mail that went straight to the pod
+ * and names the notifications it made: each is read from the account as it is
+ * now, without acting, and pushed once, while it is new. One that came from
+ * another network (Bluesky, a connected account) is not pushed, as it is not
+ * while FediPod is closed.
+ */
+const PUSH_FRESH_MS = 15 * 60_000;
+const PUSHED_KEPT = 200;
+export async function pushMade(ctx, handle, rec, ids, { log = console.log, now = Date.now() } = {}) {
+  if (!ids?.length || !await pushWanted(ctx, handle)) return 0;
+  const key = `pushed/${handle}`;
+  const done = (await getJson(ctx.mastoKv, key)) || [];
+  const want = new Set(ids.filter((id) => !done.includes(id)));
+  if (!want.size) return 0;
+  await waitOutClosing(ctx.copyKv, handle);
+  const at = await reachAccount(ctx, handle, rec, { log });
+  if (at.skipped) return 0;
+  const store = await readingStore(ctx, handle, at, log);
+  const agent = readingAgent(at, store, async () => { throw new Error('only reading'); }, log);
+  if (!agent) return 0;
+  // On the pod, a rewritten document leaves the listing as it was: what the
+  // push reads is asked for again, if it changed.
+  if (!at.inCopy) await store.refresh(['notifications.json', 'actors.json', 'statuses.json', 'webpush.json'], { ifChanged: true });
+  const fresh = store.getNotifications()
+    .filter((n) => want.has(n.id) && !n.bsky && !n.via && now - Date.parse(n.at) < PUSH_FRESH_MS);
+  if (!fresh.length) return 0;
+  const api = facade(agent, null, log, await vapidKeys(ctx.mastoKv), pushContact(ctx), { keep: false });
+  for (const n of fresh) await api.pushNotify(n).catch((e) => log(`push @${handle}: ${e.message}`));
+  await ctx.mastoKv.set(key, JSON.stringify([...fresh.map((n) => n.id), ...done].slice(0, PUSHED_KEPT)));
+  log(`@${handle}: ${fresh.length} made in FediPod pushed`);
+  return fresh.length;
+}
+
 // A request from an app, answered by the account's facade over its copy, or
 // with the hold off, over the pod.
 async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
@@ -562,12 +605,14 @@ async function route(request, pathname, ctx, deps, log) {
 
   // The pod sign-in, proved: a code for the app.
   if (pathname === '/api/authorize' && request.method === 'POST') {
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return json(401, { error: 'sign in at your pod first' });
     const body = await request.clone().json().catch(() => ({}));
     const found = await accountFor(ctx, body.address, host);
     if (found.error) return json(found.error[0], { error: found.error[1] });
     const { handle, rec } = found;
+    // A token for anyone but this account's owner is refused before it is
+    // checked: checking fetches the addresses it names.
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === rec.webId });
+    if (!webid) return json(401, { error: 'sign in at your pod first' });
     if (keptBefore(ctx, rec)) return json(503, { error: MOVING });
     if (!usable(ctx, rec)) return json(409, { error: notReady(rec) });
     if (rec.webId !== webid) return json(403, { error: `you signed in as ${webid}, and this account belongs to ${rec.webId}` });
@@ -635,13 +680,15 @@ async function route(request, pathname, ctx, deps, log) {
   const bearer = /^Bearer (.+)$/u.exec(request.headers.get('authorization') || '')?.[1];
   const tokenHash = bearer ? sha(bearer) : null;
   const tok = tokenHash ? await getJson(kv, `token/${tokenHash}`) : null;
-  if (!tok || Date.now() - tok.at > TOKEN_TTL_MS) {
+  const lastUse = tok ? tok.usedAt || tok.at : 0;
+  if (!tok || Date.now() - lastUse > TOKEN_TTL_MS) {
     // A page of this site asking with a token the gateway never gave out is
     // FediPod's own client in a browser whose worker is not answering yet:
     // told to try again, not that it is signed out.
     if (request.headers.get('sec-fetch-site') === 'same-origin') return json(503, { error: 'FediPod is starting in this browser; try again' });
     return json(401, { error: 'The access token is invalid' });
   }
+  if (Date.now() - lastUse > TOKEN_USE_MARK_MS) await putJson(kv, `token/${tokenHash}`, { ...tok, usedAt: Date.now() }).catch(() => {});
   if (pathname === '/api/v1/apps/verify_credentials') {
     const app = await appOf(kv, tok.clientId);
     return json(200, { name: app?.name || 'an app', website: app?.website || null, scopes: String(tok.scope).split(/\s+/u) });

package/lib/gateway/notices.mjs

@@ -49,7 +49,7 @@ export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToke
   }
   if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
   if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
   if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
   if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
   let body;

package/lib/gateway/outbox-door.mjs

@@ -11,10 +11,10 @@ export async function ownerPostAtDoor(request, pathname, ctx, rec, handle, { cor
   const json = (status, obj, extra = {}) => ({ status,
     headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
     body: JSON.stringify(obj) });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+  if (!isOwner(webid)) return json(403, { error: 'this outbox belongs to its owner alone' });
   const onPod = (u) => u.replace(rec.actorUrl.replace(/ap\/actor$/u, ''), rec.podHome);
   const { status, reason, location, object } = await handleOwnerPost(request, identFor(rec),
     { podPut: (u, b, ct) => ctx.podPut(handle, u, b, ct), ownerWebId: webid,

package/lib/gateway/private-read.mjs

@@ -17,6 +17,7 @@ import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
 import { asSigned } from './gateway-core.mjs';
 import { senderKeys } from './caches.mjs';
 import { keptNow } from './copy.mjs';
+import { sameOrigin } from '../core/intake/activity.mjs';
 
 const AP_CT = 'application/activity+json';
 const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
@@ -51,7 +52,12 @@ export async function signedReader(request, { fetchImpl = fetch, origin = null }
   const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+  if (!v.verified || typeof v.actor !== 'string') return { actor: null, reason: v.reason };
+  // A key document names its owner, and anyone can publish one naming anyone.
+  // Only a key on the owner's own server speaks for them — the drain's rule too
+  // (receiptVouchesFor in lib/core/intake/verify.mjs).
+  if (!sameOrigin(v.keyId, v.actor)) return { actor: null, reason: 'key-not-on-signer-origin' };
+  return { actor: v.actor, reason: null };
 }
 
 // Refused reads are told nothing, and never held at the edge.

package/lib/gateway/quiet.mjs

@@ -63,6 +63,10 @@ export async function noteReceived(ctx, key, rec, bytes) {
     .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
 }
 
+// The account's picture as its owner's browser names it, for the address's
+// WebFinger answer (front-core.mjs): an http(s) address, or none.
+const pictureOf = (v) => (typeof v === 'string' && v.length <= 2048 && /^https?:\/\/\S+$/u.test(v) ? v : null);
+
 // The owner is here. `always` is a sign-in; the relay stamps at most hourly,
 // so a busy hour of posting is one write. The count that went with the old
 // stamp is dropped: it is over, and a store should not keep one per hour.
@@ -110,10 +114,10 @@ export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
 // WebID is the row's, or lives on the row's pod for a row from before WebIDs
 // were recorded.
 export async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  if (!isOwner(webid)) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
   return { webid };
 }
 
@@ -142,6 +146,12 @@ export async function routeQuietApi(request, pathname, ctx, deps) {
     if (who.error) return who.error;
     const before = await closedState(ctx, handle, rec);
     if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    // The picture rides on the same write as the stamp. Anything that is not
+    // an address, or null, is not a picture, and changes nothing.
+    if ('icon' in body && (body.icon === null || pictureOf(body.icon)) && pictureOf(body.icon) !== (rec.icon || null)) {
+      const { icon: _was, ...rest } = rec;
+      rec = pictureOf(body.icon) ? { ...rest, icon: pictureOf(body.icon) } : rest;
+    }
     rec = await noteOpened(ctx, handle, rec, { always: true });
     // Whom the app would name if its owner lets the gateway act for them while
     // it is closed, and whether they have (held-mail.mjs, keeper.mjs); and

package/lib/gateway/state-api.mjs

@@ -162,8 +162,6 @@ export async function routeStateApi(request, pathname, ctx, deps) {
 
   if (pathname === '/api/state/open') {
     if (request.method !== 'POST') return j(405, { error: 'POST' });
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     let body = {};
     try { body = JSON.parse((await request.clone().text()) || '{}'); } catch { return j(400, { error: 'bad JSON' }); }
     // The account: named, or the one browser account kept here for this WebID.
@@ -171,8 +169,14 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     // Read fresh: FediPod asks this the moment it has turned keeping on, and a
     // row read a minute earlier would still say the account is not kept.
     let rec = handle ? await (ctx.lookupFresh || ctx.lookup)(handle) : null;
+    // A token for somebody with no account here is refused before it is
+    // checked: checking fetches the addresses it names.
+    const dir = handle ? {} : (await ctx.listDirectory?.() || {});
+    const only = handle ? (w) => !!rec && w === rec.webId : (w) => Object.values(dir).some((r) => r?.webId === w);
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only });
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!handle) {
-      const rows = Object.entries(await ctx.listDirectory?.() || {})
+      const rows = Object.entries(dir)
         .filter(([, r]) => r?.webId === webid && r.openedAt && r.keeper && !r.movedTo && !r.closedAt);
       if (rows.length > 1) return j(409, { error: 'more than one account here for this sign-in; name one', handles: rows.map(([h]) => h) });
       if (rows.length === 1) [[handle, rec]] = rows;

package/lib/gateway/token-claims.mjs

@@ -5,12 +5,74 @@
 // the claim decides nothing but the address. Verifying it here would let
 // anyone make the front fetch signing keys from a server they name, on every
 // read.
+//
+// And checking one: verifyPodToken, which the front's routes share.
 
-export function claimedWebId(request) {
+import { podTokenVerifier } from './caches.mjs';
+import { namesPrivateAddress, safeFetch, readCapped } from '../shared/safefetch.mjs';
+
+function claimsOf(request) {
   const token = /^(?:DPoP|Bearer)\s+([\w-]+)\.([\w-]+)\./u.exec(request.headers.get('authorization') || '');
   if (!token) return null;
+  try { return JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8')); } catch { return null; }
+}
+
+export function claimedWebId(request) {
+  const webid = claimsOf(request)?.webid;
+  return typeof webid === 'string' ? webid : null;
+}
+
+// Whether checking this token would stay off private addresses: the WebID it
+// names, its identity provider, and the key set that provider names. A token
+// the check cannot read fetches nothing. A provider whose settings cannot be
+// read here, by a fetch that refuses private addresses at every redirect, is
+// refused: the check's own fetch follows redirects anywhere.
+async function fetchesArePublic(request) {
+  const c = claimsOf(request);
+  if (!c) return true;
+  if (typeof c.webid === 'string' && await namesPrivateAddress(c.webid)) return false;
+  if (typeof c.iss !== 'string') return true;
+  if (await namesPrivateAddress(c.iss)) return false;
+  let jwks = null;
+  try {
+    const res = await safeFetch(`${c.iss.replace(/\/$/u, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+    jwks = JSON.parse(await readCapped(res, 64 * 1024))?.jwks_uri;
+  } catch { return false; }
+  return !(typeof jwks === 'string' && await namesPrivateAddress(jwks));
+}
+
+// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
+// verifier is injected so tests stub it; in production it is the same library
+// the agent's own C2S auth uses.
+// Checking fetches the WebID and the identity provider the token names, and a
+// stranger names them. `only`, when the caller knows whose token it wants,
+// refuses a token naming anyone else before that; `publicOnly`, where any
+// token may arrive, refuses one whose check would reach a private address.
+export async function verifyPodToken(request, pathname, verifier, { only = null, publicOnly = false } = {}) {
+  const authz = request.headers.get('authorization');
+  if (!authz) return null;
+  const claimed = claimedWebId(request);
+  if (only && claimed && !only(claimed)) {
+    console.log(`front: pod token for somebody else refused unchecked on ${pathname}`);
+    return null;
+  }
+  if (publicOnly && !await fetchesArePublic(request)) {
+    console.log(`front: pod token naming a private address refused unchecked on ${pathname}`);
+    return null;
+  }
   try {
-    const claims = JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8'));
-    return typeof claims?.webid === 'string' ? claims.webid : null;
-  } catch { return null; }
+    const dpop = request.headers.get('dpop');
+    // Solid-OIDC binds the token to a key the client proves on every request;
+    // a token shown without the proof is one anyone who saw it could show.
+    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
+    const v = verifier || await podTokenVerifier();
+    const url = request.url;
+    const { webid } = await v(authz, { header: dpop, method: request.method, url });
+    return webid || null;
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }

package/lib/pod/actor.mjs

@@ -73,6 +73,11 @@ export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person'
   return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
+/** The same link taken out again, for an account retired for good. */
+export async function unlinkInWebIdProfile(pod, { actorUrl, outbox = null }) {
+  return pod.unlinkAccountInProfile({ actorUrl, outbox });
+}
+
 // ---- anyone at all ----
 
 /**

package/lib/pod/transport.mjs

@@ -534,6 +534,34 @@ export class PodTransport {
     return true;
   }
 
+  /**
+   * The account taken out of the WebID profile again, as linkAccountInProfile
+   * wrote it: the foaf:account link, what the profile says of the actor, and
+   * `outbox` when it is the one named. From every document of the profile that
+   * holds any of it, each write checked. Returns how many documents changed.
+   */
+  async unlinkAccountInProfile({ actorUrl, outbox = null }) {
+    const me = $rdf.sym(this.webId);
+    const actor = $rdf.sym(actorUrl);
+    let changed = 0;
+    for (const d of await this.profileDocs(podBaseOfWebId(this.webId))) {
+      if (!d.g) continue;
+      const gone = [
+        ...d.g.statementsMatching(me, FOAF('account'), actor),
+        ...d.g.statementsMatching(actor, RDF('type'), FOAF('OnlineAccount')),
+        ...d.g.statementsMatching(actor, RDF('type'), AS('Person')),
+        ...d.g.statementsMatching(actor, RDF('type'), AS('Group')),
+        ...d.g.statementsMatching(actor, FOAF('accountName'), null),
+        ...(outbox ? d.g.statementsMatching(me, AS('outbox'), $rdf.sym(outbox)) : []),
+      ].map((st) => [st.subject, st.predicate, st.object]);
+      if (!gone.length) continue;
+      const status = await this.writeRdfChecked(d.url, d.g, { deletes: gone, mustDescribe: d.profile ? this.webId : null });
+      if (status >= 300) throw new Error(`not written: ${d.url} → ${status}`);
+      changed++;
+    }
+    return changed;
+  }
+
   /**
    * An N3 Patch of exactly these statements, or false when the pod will not
    * take one and the caller should write the document instead.

package/lib/pod/type-index.mjs

@@ -65,6 +65,29 @@ export async function register(pod, indexUrl, actorUrl) {
   return true;
 }
 
+/**
+ * Take the account's registration out again. A registration that names other
+ * instances too keeps them and loses only this one. True when one was there.
+ */
+export async function unregister(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) return false;
+  const actor = pod.sym(actorUrl);
+  const instance = pod.sym(SOLID + 'instance');
+  const gone = [];
+  for (const reg of g.each(null, instance, actor)) {
+    if (!g.holds(reg, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR))) continue;
+    const others = g.each(reg, instance, null).filter((i) => i.value !== actorUrl);
+    for (const st of others.length ? g.statementsMatching(reg, instance, actor) : g.statementsMatching(reg, null, null)) {
+      gone.push([st.subject, st.predicate, st.object]);
+    }
+  }
+  if (!gone.length) return false;
+  const status = await pod.writeRdfChecked(indexUrl, g, { deletes: gone, mustDescribe: indexUrl });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not let the registration go (${status})`);
+  return true;
+}
+
 /**
  * Make a public type index and name it from the profile. Only ever called
  * after the person has said yes. An index already at the usual place is kept,